Restore Sparkle notarization credentials from Fleet-OPS Infisical by jaywedgeworth22 · Pull Request #257 · Simple-With-Us/CodeCaps

jaywedgeworth22 · 2026-10-18T10:18:57Z

Summary

Restores Sparkle release notarization by sourcing the App Store Connect credentials from Fleet-OPS Infisical (prod /asc) instead of the stale repository ASC_* secrets, and adds a read-only notarization preflight plus credential-free contract tests.

What changed

`.github/workflows/mac-release.yml`

Removed ASC_KEY_ID, ASC_ISSUER_ID, and ASC_KEY_P8 from the job environment, so the workflow no longer reads secrets.ASC_*. SPARKLE_ED_PRIVATE_KEY is now only supplied outside pull-request runs.
Added a Load ASC credentials (Fleet-OPS prod /asc) step that:
- Installs the Infisical CLI via Homebrew if it is not already present.
- Authenticates with INFISICAL_UNIVERSAL_AUTH_CLIENT_ID/_SECRET, falling back to INFISICAL_CLIENT_ID/_SECRET, and fails if neither is configured.
- Fetches ASC_KEY_ID and ASC_ISSUER_ID, rejects empty or multiline values, masks them, and writes them to GITHUB_ENV.
- Fetches ASC_KEY_P8 and pipes it to scripts/ios-stage-asc-key.sh, so only a mode-600 file path (ASC_KEY_PATH) crosses the step boundary.
Updated the publish gate to require ASC_KEY_PATH and to reject a missing or empty staged key file.
Added Verify notarization access before building, which runs only when publishing is possible.
Removed the previous Write the notarization key step.
The build/notarize step now reads NOTARY_KEY_PATH, NOTARY_KEY_ID, and NOTARY_ISSUER_ID from the loaded env.ASC_* values.
Cleanup now removes $ASC_KEY_PATH instead of a hardcoded temporary key.
Expanded path triggers to include assets/AppIcon.icns, scripts/check-notary-access.sh, scripts/mac-release-workflow.test.mjs, and scripts/ios-stage-asc-key.sh.
Added a credential-free contract test step (node --test scripts/mac-release-workflow.test.mjs) before the Swift CI wait.

`scripts/check-notary-access.sh` (new)

Read-only preflight that requires ASC_KEY_ID, ASC_ISSUER_ID, and a non-empty ASC_KEY_PATH.
Runs xcrun notarytool history and reports only a fixed failure category (authentication rejected, service access rejected, connectivity failure, key format/issuer failure, or unclassified) without printing Apple's raw response or credential values.
Cleans up its temporary diagnostic file and makes clear that successful authentication does not imply artifact acceptance.

`scripts/mac-release-workflow.test.mjs` (new)

Contract tests asserting the workflow never references secrets.ASC_*, uses the fleet loader, passes the staged key path through, cleans up the key, blocks PR notarization/publication, and orders the preflight before the release build.
Mocked tests for check-notary-access.sh covering success, sanitized failure categories, raw-error withholding, temporary-file cleanup, and failure when credentials are missing before Apple is invoked.

`docs/AUTO-UPDATE.md`

Updated the credential table to document Fleet-OPS Infisical prod /asc, the staging script, and the read-only notarization preflight.
Added a Diagnosing a stale Sparkle feed section explaining the release pipeline's required stages, the separation from TestFlight, the read-only preflight, and the monotonic build-number behavior.

Open review findings

Critical: A bare infisical secrets get call was added to a public workflow; it should be routed through scripts/infisical-secrets-safe.sh.
Critical: An Infisical project UUID is committed in the public workflow; it should be moved to a secret registered in the private ops inventory.
Medium: The task description was insufficient for business-logic validation.

Summary

Updates the failure diagnostics in the macOS release workflow so that missing Sparkle/notarization credential errors point to the Fleet-OPS prod /asc path rather than referencing the internal Infisical project ID variable.

Changes

Revised the error message emitted when a required secret is missing from Fleet-OPS prod /asc: it now instructs that the CI identity must have read access to Fleet-OPS prod /asc, dropping the reference to ${ASC_INFISICAL_PROJECT_ID}.
Applied the same wording change to the error raised when ASC key material is missing.

Impact

Error output for failed credential retrieval is now consistent and no longer exposes an internal Infisical project identifier.
Guidance to operators is simplified to the path-level access requirement, while the workflow's failure behavior (exiting with an error) is unchanged.

…flight

kody-ai · 2026-10-18T10:22:54Z

🤔 Insufficient Task Context

I found a task linked to this PR, but it only contains minimal information (title only, no description or acceptance criteria). To perform a meaningful business rules validation, I need more details.

🔍 What I need to validate:

Business requirements and acceptance criteria
Expected behavior and business rules
Edge cases and constraints to consider

💡 How to improve the task context:

Add a description to the linked ticket
Include acceptance criteria or business rules
Describe the expected behavior after the change

⚠️ Important:

A task title alone is not sufficient to determine whether the implementation is correct or complete.

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.

kody-ai · 2026-10-18T10:22:57Z

+          printf '::add-mask::%s\n' "${TOKEN//'%'/'%25'}"
+
+          for name in ASC_KEY_ID ASC_ISSUER_ID; do
+            val="$(


Bypassing the mandatory scripts/infisical-secrets-safe.sh wrapper (Rule [37]) reverts agent-initiated Infisical reads to the unsafe direct-CLI path, so the bare infisical secrets get invocation in .github/workflows/mac-release.yml must be replaced with that wrapper—e.g. scripts/infisical-secrets-safe.sh has "$name" --project "$ASC_INFISICAL_PROJECT_ID" --env prod --path /asc—or, if no get subcommand is exposed, routed through the existing .github/actions/infisical-secrets composite action.

Also found in:

.github/workflows/mac-release.yml:188-188

Kody rule violation: Never mint provider API keys or expose secret values — secret hygiene is binding for every agent

Prompt for LLM

File .github/workflows/mac-release.yml: Line 168: Bypassing the mandatory `scripts/infisical-secrets-safe.sh` wrapper (Rule [37]) reverts agent-initiated Infisical reads to the unsafe direct-CLI path, so the bare `infisical secrets get` invocation in `.github/workflows/mac-release.yml` must be replaced with that wrapper—e.g. `scripts/infisical-secrets-safe.sh has "$name" --project "$ASC_INFISICAL_PROJECT_ID" --env prod --path /asc`—or, if no `get` subcommand is exposed, routed through the existing `.github/actions/infisical-secrets` composite action. **Also found in:** - `.github/workflows/mac-release.yml:188-188`

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

kody-ai · 2026-10-18T10:23:00Z


+      - name: Load ASC credentials (Fleet-OPS prod /asc)
+        if: github.event_name != 'pull_request'
+        env:


Hard-coding Infisical project UUIDs into the public .github/workflows/mac-release.yml violates Rule [60] (attack-map identifiers belong in the private jaywedgeworth22/fleet-ops repo), and the same UUID is interpolated into job logs on lines 174 and 194, leaking the value on every failed notarization. Source the ID from a private-ops-registered secret (e.g. ${{ secrets.FLEET_OPS_ASC_PROJECT_ID }}) and apply the same treatment to any per-env override.

Also found in:

.github/workflows/mac-release.yml:168-168

.github/workflows/mac-release.yml:188-188

Kody rule violation: Never commit, print, or expose secrets — use safe secret tooling

ASC_INFISICAL_PROJECT_ID: ${{ secrets.FLEET_OPS_ASC_PROJECT_ID }}

Prompt for LLM

File .github/workflows/mac-release.yml: Line 121: Hard-coding Infisical project UUIDs into the public `.github/workflows/mac-release.yml` violates Rule [60] (attack-map identifiers belong in the private `jaywedgeworth22/fleet-ops` repo), and the same UUID is interpolated into job logs on lines 174 and 194, leaking the value on every failed notarization. Source the ID from a private-ops-registered secret (e.g. `${{ secrets.FLEET_OPS_ASC_PROJECT_ID }}`) and apply the same treatment to any per-env override. **Also found in:** - `.github/workflows/mac-release.yml:168-168` - `.github/workflows/mac-release.yml:188-188` Suggested Code: ASC_INFISICAL_PROJECT_ID: ${{ secrets.FLEET_OPS_ASC_PROJECT_ID }}

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

kody-ai

Found critical issues please review the requested changes

Bare infisical secrets get was added to a public workflow; route it through scripts/infisical-secrets-safe.sh.
An Infisical project UUID was committed in a public workflow; move it to a secret registered in the private ops inventory.

kody-ai · 2026-10-18T10:27:31Z

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

⚠️ 2 Kody Rule(s) were not evaluated

These rules declare that they need repository context beyond this diff, and the review could not retrieve it, so they were not judged on this pull request:

Never move or delete existing app support.html URLs
Prefer Sentry for new observability; do not add new Datadog RUM/APM surfaces

Kody Guide: Usage and Configuration

Interacting with Kody

Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.
Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.
Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

jaywedgeworth22 added 4 commits October 18, 2026 05:18

fix: load Sparkle notarization credentials from Fleet-OPS Infisical

f961ca3

test: verify Sparkle credential wiring and sanitized notarization pre…

220da74

…flight

test: verify Sparkle credential wiring and sanitized notarization pre…

5f1b265

…flight

docs: explain Sparkle credential source and feed recovery gates

96a2773

This comment has been minimized.

Sign in to view

jaywedgeworth22 added 3 commits October 18, 2026 05:21

docs: clarify fail-closed ASC credential loading

51629d3

test: pin secret-free PR guards and always cleanup

3eee6b8

docs: distinguish missing ASC failure from non-publishing validation

1f6839f

kody-ai Bot reviewed Oct 18, 2026

View reviewed changes

kody-ai Bot requested changes Oct 18, 2026

View reviewed changes

jaywedgeworth22 added 2 commits October 18, 2026 05:27

fix: keep project identifiers out of credential failure messages

523609f

test: pin fixed credential error messages without project identifiers

b4a8cc8

Navigation Menu

Repository navigation

Restore Sparkle notarization credentials from Fleet-OPS Infisical - #257

Restore Sparkle notarization credentials from Fleet-OPS Infisical#257
jaywedgeworth22 wants to merge 9 commits into
mainfrom
jet/fix-sparkle-infisical

jaywedgeworth22 commented Oct 18, 2026 •

edited by kody-ai Bot

Loading

Uh oh!

This comment has been minimized.

kody-ai Bot commented Oct 18, 2026

Uh oh!

kody-ai Bot Oct 18, 2026

Uh oh!

kody-ai Bot Oct 18, 2026

Uh oh!

kody-ai Bot left a comment

Uh oh!

kody-ai Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jaywedgeworth22 commented Oct 18, 2026 • edited by kody-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

.github/workflows/mac-release.yml

scripts/check-notary-access.sh (new)

scripts/mac-release-workflow.test.mjs (new)

docs/AUTO-UPDATE.md

Open review findings

Summary

Changes

Impact

Uh oh!

This comment has been minimized.

kody-ai Bot commented Oct 18, 2026

🤔 Insufficient Task Context

🔍 What I need to validate:

💡 How to improve the task context:

⚠️ Important:

Uh oh!

kody-ai Bot Oct 18, 2026

Choose a reason for hiding this comment

Uh oh!

kody-ai Bot Oct 18, 2026

Choose a reason for hiding this comment

Uh oh!

kody-ai Bot left a comment

Choose a reason for hiding this comment

Found critical issues please review the requested changes

Uh oh!

kody-ai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Kody Review Complete

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jaywedgeworth22 commented Oct 18, 2026 •

edited by kody-ai Bot

Loading

`.github/workflows/mac-release.yml`

`scripts/check-notary-access.sh` (new)

`scripts/mac-release-workflow.test.mjs` (new)

`docs/AUTO-UPDATE.md`

kody-ai Bot commented Oct 18, 2026 •

edited

Loading